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(57) Abstract: Method and apparatus for a distributed switching system supporting a plurality of services. A service request is 
initiated by an initiating customer. The service request is then executed using, for example, a user-to-network: interface setup. A 
terminating setup is then performed to either accept or reject the requested service. Multiple service requests correlated with 
respective services to enable at least one appropriate policy and logic. Data related to the requested service is obtained using at least 
one of a push procedure, a pull procedure, a query procedure^ arid a procedure in which requests are associated with the issuance of 
certificates. ■ 
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MULTISERVICE USE OF NETWORK CONNECTION CAPABILITY 
UNDER USER-TO-NETWORK INTERFACE SIGNALING 

BACKGROUND OF THE INVENTION 

5 1. Field Of The Invention 

The present invention is directed to a distributed switching system, such as, for example, 

a Multiservice Switching System based on, for example, frame, cell or packet switching, that 
supports video, private line and data services. 

2. Discussion Of Background And Related Information 

10 A Multiservice Switching System (MSS) comprises a distributed switching device 

designed to support plural forms of data, such as, but not limited tO:, for example, voice, computer 
data and video signals. Switching can be based on, for example, but not limited to, fratne, cell, 
or packet switching. Multiservice Switching Systems may use a broad range of access 
technologies, including, but not limited to, for example, time (Hvision multiplexing (TDM), digital 

15 subscriber lines (xDSL), wireless, and cable modems. 

In an ATM switched virtual circuit (SVC) service, a SVe customer can either ^ 
terminate a SVG service request via a user-to-network (UNI) interfece. The SVC customer may 
be, but is not limited to, for example, an individual subscriber, an enterprise network, an ISP, or 
a peer network. Service policies define the capabilities and resources available to the customer. 

20 The service policies also determine whether a service request succeeds or fails. 

The amount of data being transmitted between locations has rapidly escalated. Voice 
networks (e.g., traditional telephone networks) are becoming overwhelmed by the rapidly 
increasing traffic flow. Further, it is costly to construct/expand such traditional telephone 
networks. As a resxxlt, companies are searching for ways to carry voice services over packet 

25 networks, and for removing data traffic from the voice networks. Thishas led to the development 
of media gateways and media gateway controllers (referred to as distributed switches) that 
separate the service intelligence from the associated hardware, and allows voice and data to be 
carried over a packet network. 

Conventional architectures do not permit the separation of a service controller from a 

30 transport controller. For example, in a conventional ATM switch, a calling party uses the UNI 
protocol to request an ATM SVC connection to another end system that is connected to the 
network. This request is carried by a signaling channel to an ATM edge switch, which terminates 
the UNI protocol and initiates a private network-network interface (PNNI) protocol to complete 
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a setup across the network to the edge switch that connects to the called party. The application 
of policy and decision to reject or accept a call is determined solely by an on-board processor 
within the switch. That is, service control is packaged urtd the switch. No standardized ATM 
mechanism currently exists to utilize service control outside of the switch, 
BRIEF DESCMPTION OF THE DRAlWINGS 

The foregoing and other objects, features and advm^ 
from the following more particular description of preferred embodiments, as illustrated m the 
accompanying drawings, which are presented as a non-limiting example, in which reference 
characters refer to the same parts thro 

Fig; 1 illustrates an example ATM SVC service that utihzes inteU^ 
conventional ATM Switches that are useable with the present invention; 

Fig. 2 illustrates a conventional ATM Edge Switch and conventional SVC iService 
CoiitroUer useable with the example ATM SVC service of Fig. 1; 

Fig. 3 illustrates a next generation ATM Edge Switch and SVC Service and Svritch 
Controller useable with the example ATM SVC service of Fig. 1; 

Fig. 4 illustrates an operation chart for a push method performed in accordance with the 
instant invention; 

Fig. 5 illustrates an operation chart for a pull method and a query method performed in 
accordance with the instant mvention; and 

Fig. 6 illustrates an operation chart for a metliod using certificates performed in accordance 
with the instant invention. 

DETAILED DESCIUPTION OF EMBODIMENTS 

Accordingly, an object of the current invention is to provide a mechanism whereby a 
switch, such as, for example, an ATM switch, can access an external service control. In particular, 
the present invention allows multiple network services to share a network connection capabiUty 
in such a way that a predetermined signal, such as, for example, UNI signaling, is interpreted via 
service specific controls (such as, for example, data, policies and transformations) contained 
within the network. This is achieved in a unifonn manner, such that policies can be made globally 
available in the network. Further, user policy can be applied independent of the manner in which 
the user accesses the network. 

According to an object of the present invention, a multiservice switching system has a 
switching device having predetermined functions with respect to a request for a predetermined 
service, a switch controller that has a bearer function and a virtual switch function m order to 
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control the switching device, and a proxy device that contains service policies related to either 
enabling or denying the predetermined service, in w 

with respective services to enable at least one s^ropriate policy and logic. The switching device 
and the switch controller may comprise a conventional switch, such as, for example, an ATM 

5 Switch, or a next generation switch. 

Accorditig to a feature of the invention, the midtiservice switching system fuxth 
comprises a service controller. The service controller may include the switch controller. 
Alternatively, the switching device may include the switch controller^ 

According to another object of the invention, amethod is disclosed for switcl^ 

10 forms of data. A customer initiates a request for service. In response to the request, 
predetermined data related to the requested service is obtained. If the requested service is 
permitted, the initiating customer is instructed to initiate a setup, such as, for example, a UNI 
setup, identifying the requested service. A PNNI protocol (setup) is completed across a network 
in response to the UNI setup, and a second UNI setup is initiated to accept or reject the service 

15 request, which is passed back to the initiating customer, wherein multiple service requests are 
correlated with respective services to enable at least one appropriate policy and logic. 

According to a feature of the invention, the data related to the requested service may be 
obtained using at least one of a push procedure that pushes the predetermined data, a pull 
procedure that puUs policy and/or logic (e.g., a program) representing at least one of service 

20 capabilities and service permissions, a query (trigger) procedure that queries a service control 
module, or a certificate procedure that specifies permitted setup parameters. The push (download) 
procedure and the pull procedure pushes and pulls, respectively, information into a Ketwork 
Connection Capability, and then makes a decision regarding a service. The query procedure 
provides facts (e.g., policy and/or logic), and then the service makes a policy and/or logic 

25 decision. 

According to an advantage of the invention, the certificate may be encrypted. In addition, 
a sequence number, that assists in preventing reuse of the certificate, may be assigned to the 
encrypted certificate. By examining the sequence number assigned to the certificate, it is possible 
to determine whether the sequence number (and thus, the certificate) was seen before. In addition 
30 to the assignment of the sequence number (or instead of using the sequence number), the 
certificate can be time-stamped and/or date-stamped. An examination of the time-stamp and/or 
date-stamp (with or without the sequence number) assists in determining whether the certificate 
is valid. If the time-stamp and/or date-stamp exceeds a predetermined delta value, the certificate 
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is determined to be invalid, and thus, the service request is denied, 

A still further advantage of the invention resides in the encrypted certificate being able to 
identify which service allowed the setup. 

According to another object of the invention, a method for switching plxual forms of data 
5 is disclosed. The method comprises initiating a service request by an initiating customer, 
establishing the service request using a predetermined setup, such exainple, a user-to- , 

network inter&ce setup, and initiating a second predetermined setup, such as, for example, a user- : 
to-network interface setup, to accept or reject the requested service, \vherein m 
requests are correlated with respective services to enable at least one appropriate policy and logic, 
10 According to a feature of the invention, a Service Control may request that initiating 

customer initiate the user-to-network interface setup. 

According to another feature, if the service request is transferred over an ATM 
the user-to-network uiterface setup is redirected from a switching device to a service controller, 
Accordmg to an advantage of the hiventiori, the switchmg device ^ 
15 controller. The switch controller may be integral with the switching device, or, alternatively, the 
switch c6ntrolle;r may be integral with the service controller. 

Another advantage of the invention is that the service request may be established using at 
least one of a pushing procedure, a pulling procedure, a query procedure, and a certificate 
procedure. If the certificate procedure is employed, a certificate may establish what service 
20 requests uses the user-to-network interface setup. Further, the certificate may specify what setup 
parameters are permitted and/or which service allowed the setup. 

If desired, the certifi cate may be encrypted. In addition, at 1^^ 
a time-stamp, and a date-stamp may be iised with the certificate to assist in verifying that a 
certificate is valid. Thus, reuse ofa certificate may be prevented. 
25 Fig. 1 discloses an example ATM SVC Service that can use the present mvention, 

comprising an mitiating SVC service customer 10, a first ATM edge switch 12, an ATM core 
switch 14, a second ATM edge switch 16, a terminating SVC service customer 18, a firet SVC 
service controller 20, a second SVG service controller 22, and a proxy device, such as, for 
example, a SVC service policy device 24. However, it is xmderstood that modifications to this 
30 arrangement may be made without departing fiom the scope and/or spirit of the inventio 

Further, while the present invention is being described with reference to a UNI signal, it 
is understood that alternative signal protocols may be used without departing from the spirit and/or 
scope of the invention. 
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The SVC customer 10 either initiates or terminates an SVG Service Request usmg UNI 
signaling. The SVC customer 10 may correspond tOy for example, an individual subscriber, an 
enterprise network, an ISP or a peer network. In addition, an ISDN to ATM gateway may also 
act on behalfofaii SVC customer. Sendee policies define the capabilities and resources available 

5 to the customer, and also, determine whether a service request succeeds or fails. Example SVC 
service class capabilities include, but are not Umited to, constant bit rate (CBT), real time variable 
bit rate (rt-VBR); iion-real time variable bit rate (nrt-VBR), unspecified bit rate (UBR), available 
bit rate (ABR), calling line identification presentation and restriction (CLIP/CLIR). Example 
resources include, but are not limited to, for example, total bandwidth and total number of SVC's. 

10 Fig. 1 illustrates the ATM SVC being implemented with conventional ATM switches that 

contain both bearer control and virtual switch control in addition to the switching function, the 
structure of which is shown in greater detail in Fig. 2. According to the present invention, the 
ATM SVC Service Control (e.g., network service instance control function NSICF) is removed 
fix)m a switching device (e.g., ATM edge switch 12 or 1 6) and placed within a separate physical 

15 controller. In the first embodiment, bearer control and vutual swito^^ 

(as a switch controller) with switching as part of a single physical unit, and the NSICF is bundled 
separately as the SVC Service Controller. UNI signaling is redirected fix^m the edge switch to the 
SVC Service Controller via a permanent virtual circuit (PVC). This allows the SVC Service 
Controller to apply policy and/or other transformations to UNI setup messages. If the SVC 

20 Service Controller permits a setiq), the SVC Service Controller functions as a proxy agent for the 
SVC Service Customer, in accordance with, for example, Annex 2 of ATM UNI Signaling 
Specification Version 4,0, and issues a UNI setup command to the ATM Edge Switch. 

Fig. 2 illustrates a conventional switch. The conventional ATM Edge Switch 12 (or 16) 
comprises a first physical port 26, a virtual switch 28, a second physical port 30, a virtual switch 

25 controller 32, a bearer controller 34, and a third physical port 36. The first physical port 26 
includes a signalmg gateway 38 and a logical port 40, while the second physical port 30 includes 
a logical port 42. 

The SVC Service Controller 20 (or 22) includes a first physical port 44, a Network Service 
Instance Control Function (NSICF) 46, and a second physical port 48. 
30 As shown in Fig. 2, an optional Service Gateway 50 is interfaced between the SVC Service 

Controller 20 (or 22) and the policy Server 24. 

It is noted that the construction and operation of the ATM E^e Switch, the SVC Service 
Controller and the Service Gateway is known to those skilled in the art Thus, a detailed described 
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of the structure and operation of these elements is omitted It is further understood that variations 
in the construction of the Edge Switch, SVG Service Controller and Service Gateway may be 
made without departing from thescope and/or spirit of the inventioiL 
WMle the invention is described with respect to an 
5 the invention is not limited to ATM SVG service, but may be utilized with other network services. 

Iel order to implement the ATM SVC Service outside of the conventional switch, a UNI 
signaling channel, produced by an SVC Service Customer, is redirected to an SVG Service 
Controller by a PVG or S-PVC. An SVC Service Customer may correspond with an individual 
subscriber (connected by, but not limited to, for example) an xDSL connection^ an ISDN 
10 connection (using, for example, an ISDN to ATM Internetwork gateway), an enterprise network, 
an ISP or a peer network. In tiie disclosed embodiment, policies are stored in the database 
(e.g., policy server) that is physically septate fiom an individual Service Controller 20 (or 22). 
Thedatabase24isaccessedbyaservicegateway 52 associated with the Service Gateway 50, The 
policy server 24 checks policies of both the calling party and the caUed party. 
15 wMle the poUcy server 24 is shown as being physicaUy separate fr^ 

Controllers, it is understood that variations in form, such as, but iiot limted to, for example, 
incorporating the policies in one or more SVG Service Controllers 20 (or 22), may be made 
without departing from the spirit and/or scope of the invention. 

The present invention discloses the use of a predetermined setup, such as, for example, 
20 UNI version 4.0 proxy, for the purpose of accessing bearer control As a result, the NSICF 46 
terminates the UNI stack However, it is understood that different protocols (such as, but not 
limited to, UNI version 3. 1) may be used for accessing bearer control without departing from the 
scope and/or spirit of the invention. 

Fig. 3 illustrates an example of an ATM Switch, m which the ATM SVC Service is 
25 implemented using a next generation Multiservice Switching Function (MSF) ATM switch 54. 
Inthis regard, elements in this example that conespond to like elements in the first exa^^ 
designated with the same element number. Further, a detailed discussed of such elements is not 
required. 

In the second example, the virtual switch controller 32 and the bearer controller 34 are 
30 removed from the switch and are placed in a separate SVC Service Switch Controller 56, along 
with the NSICF 46. Further, UNI signaling passes through the switch 54 and on to the NSICF 46 
within the Switch Controller 56. It is noted that for purposes of simplification. Fig. 3 omits 
physical paths sp and vsc. 
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The NSICF 46 applies policy and screening to a UNI setup message based on a calling 
party and a called party, a requested service class, etc., via the service feature gateway function. 
If the setup message is successful, the NSICF 46 invokes the bearer control function 34: that . 
resides within the Switch Controller 56 that provides access to the netWOTk' s SVC capability. The 
5 Signaling Gateway function is placed within the physical port to denote that the UNI signaling 
crosses the boundary from customer to network, and that it is being re-directed via a PVC to the 
NSICF. No policy is appUed and the transport of the signaling does^^ n^^ The Bearer 

Control fimction 34is implemented by initiating a PNNI protocol in the network direction m order 
to create a bearer connection across the nety^^ork. Further, the Log^^^ 
1 0 via the virtual switch control function along sp to access t^^^ 

It is noted fhat in a multiservice environment, service control is not limited to ATM 
SVG's. Other transport devices, such as, but not limited to, for example. Frame relay and IP 
layered on top of ATM, may be used. 

The present invention solves the problem of multiple services sharing the same Network 
15 Connection CapabUity while utilizing a common UNI Signaling method. In the foUowmg 
discussion, it is assumed that a calling party needs to access different: Network Connection 
Capabilities based upon the services the calling party participates in. 

According to the instant invention, service customers access a service using either a 
dedicated signaling channel or a signaling network (which may optionally be IP based). During 
20 a service interaction, an ATM SVC Connection must be established between customers. Thus, 
one of tiie end-systems initiates a UNI setup. Once the UNI initiates tiie SVC's between the ATM 
SVC Service and other Services, the Network Connection Capability correlates the callmg party 
setup request with the service it belongs to, so that an appropriate policy is applied. 

The end-systems, the service, and the Network Connection Capability must coordinate 
25 their actions. Specifically, die Network Connection Capability must enable the enforcement of 
the service policy and/or logic (e.g., a program module) at least during the initial setup. In^ 
addition, tiic called party must be able to map an mcoming UNI to the appropriate 
service/ application. 

Four procedures are discussed below for enabling enforcement of the service policy and/or 
30 logic, in accordance with the present invention. However, it is understood that the mvention is 
not limited to the four procedures discussed below, and thus, should not be interpreted as limiting 
the scope of the invention; alternative procedures may be employed without departing from the 
scope and/or spirit of the invention. 
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In the first procedure, to be discussed in detail below, the Service downloads (pushes) 
poUcy and/or logic into the Network Gonnection CapabiHty hefo^^^ 

aUNI setup. In the second procedure, to be discussed in detail below, the Network Connection 
Capability pulls m policy and/or logic from the Swdce when it receives a setup or other signaling 

5 message. In the thkd procedure, to be discussed in detail below, the Network Connection 
Capability queries the Service when it receives a setup or other signaling mes^^^ In the fourth 
procedure, to be discussed below m cietail, the Service sends the service customer an encrypted 
certificate that allows a setup phas6 to go through without requiring interaction between the 
Service and the Network Connection Capability. 

10 It is noted that the Network Connection Capability must be able to map the incoming setup , 

to the corresponding service in the first through third procedures. In the fourth procedure, the 
service provides the end-system Avith a (preferably non-reusable) certificate that allows it to do 
the pennitted setup. The end-system of the fourth procedure includes the certificate in its setup 
message, so that the controller does not have to consult wifli the service in order to determine 

15 whetherto allow Ihe setup. It is noted that while the certificate is preferably encrypted with the 
permissions as well as a sequence number, this is not a requirement of Hie instant mvention. 

The first procedure will now be described with reference to Fig. 4. In the first procedure, 
policy and/or logic is pushed (downloaded) into the Netwo± Connection Capability before it 
requests the end-system to do a UNI setup. In accordance with this procedure, the Network 

20 Connection Capability maps the incoming setup to a corresponding service. This requires 
encoding a service mstance unique ID (s Jd), using known techniques, in the setup firom the 
calling party. 

At step 1 (see Fig. 4), a service request is made to a Service Controller 58. The Service . 
Controller 58 then pushes (step 2) policy and/or logic to control the Network Connection 

25 Capability. Then, in step 3, the Service Control 58 requests that the seryice customer 10 initiate 
a UNI setup containing the s Jd. The UNI setup is directed (step 4) from the customer 10 to the 
SVC Controller 20 (located within the Network Connection Capability), arid contaiiis the s Jd. 
Since multiple customers may initiate multiple SVQ's corresponding to a single service, the s Jd 
functions to identify the service and the SVC instance for the particular customer. 

30 In step 5, a proxy UNI is sent to the edge switch 12. As a resulty PNNI is transmitted 

across the network (step 6), which results in the forwarding of a proxy UNI to the SVC Controller 
22 (located within the Network Connection Capability) at step 7. Thereafter, step 8 is performed 
to mitiate UNI to the service customer 1 8. 


8 
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In order for the customer to map the mc^ 
contains an application identifier or one of the SVC Controller 22 or the Service Control 58 must 
al^the service customer 18 of the incoming UNI and its Virtual Path IdentifierA^irtaal Channel 
Identifier (VPIA^CI), which is illustrated in Fig. 4 as step 7.5. If the application identifier and 

5 service identifier are the same, the s_id can be used. However, since this may not be the case, a 
different identifier is preferably used. 

The second procedure will now be described Mrith reference to Fig. 5, In the second 
procedure, the Network Connection Capability pulls in policy and/or logic in a manner similar to 
that described in the first pirocedure. 

1 0 At step 1 (see Fig. 5), a service request is made to the Service Control 58. In step 2, the 

Service Control 58 requests that the service customer 10 initiate a UNI setup contaimng s_id. Hie 
^ directed (step 3) from the customer 10 to the SVC Controller 20 (located witiun the 

Network Connection C^ability), and contains th^ Since multiple customers may initiate 
multiple SVC'scorres^^ to a single service, the sjd fimctions to identify flie service and 

15 tiie SVC instance for the particular customer. Step 4 is then performed, in which the Network 
Connection Capability pulls policy and/or logic from tiie Service Control 58, which is completed 
by the reply provided in step 4.5, 

In step 5, a proxy UNI is sent to the edge switch 12. As a result, PNNI is used to do an 
SVC across tiie network (step 6), which results in a proxy UNI to the SVC Controller 22 (located 

20 within tiie Network Connection Capability) at step 7. Thereafter, step 8 is performed to initiate 
UNI to the service customer 18. As in the first procedure, tiie SVC Controller 22 or the Service 
Control 58 alerts (step 7,5) flie service custoiner 18 of tiie incoming UNI and its VPWCI. 

The tiiird procedure will now be described. As this procedure is similar to the puU 
procedure (e.g., second procedure) described above, the following discussion will only be directed 

25 to the differences. 

In the third procedure, an incoming setup message results in a query to an ^propriate 
service control module. Other queries, based, on, for example, mid-call signaling events, can also 
be defined. The query procedure includes a query and a response. In the case of a setup, the 
response contains information indicating whether the setup should go through, and under what 

30 conditions. 

It is noted that in the second and third procedures, the uiteraction between the Network 
Connection Capability and the Service Control 58 must be timely, ui order to avoid a time out 
condition. Further, the sjd is needed in the setup that uniquely identifies the service. 


9 
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The third procedure differs from the jfirst and second procedures in at least one important 
respect SpecificaUy; in the query procedure, the service is not con^ of 
the SVC ControUer that interprets sendee policy and/or logic. 

The fourth procedure will now be described with reference to Fig. 6. In the fourth 
5 procedure, multiple services use the same network connection capability under UM Signalmg 
without requiring an mteraction between the services and the netw 

accordance with this procedure, the Service Control 58 provides flie service customer 10 with a 
certificate allowing it to do a perautted setup. The certificate^^ ^^s^^^ 
parameters. The service customer 10 includes the certificate in its setup message. In ttiis regatrdy 
10 it is noted that the network connection cai^ility does not need to consult wift 

58 in order to allow the setup. The certificate uniquely identifies winch service aUowed the setup,^ ^ 

so that billing and accounting can be properly perfonned when tW^ 

parties. 

While the following discussion indicates that the certificate arc^^ 
15 the encryption may be omitted witiaout departing firom tiie spirit and/or scope of the invention. 
It is also noted tiiat the certificate may contain the permissions and/or a sequence nui^ 
According to the disclosed fourth procedure, certificates are non-re^ 
may happen asynchronously, die certificates may not neces^^ 
received. 

20 Each network service (s) has a private key (E.s) that is used to encrypt certificates. For 

each encryption key, the network connection capability has a private decryption key (p.s). As a 
result, only the network connection capability can read a certificate, and only the network service 
can have originally generated flie certificate. Furtiier, according to flie disclosed procedure, each 
certificate is preferably encrypted with a unique sequence number in order to ensure that a 

25 previous certificate is not used again. When the Network Connection Capability decrypts a 
certificate, the Network Connection Capability examines the sequence number to determine 
whether the certificate has been seen before. 

Keeping a record of each and every certiflcate (wit^^ tiiat 
has been received would require a very large database. In order to in^ the size of this 

30 database, a preferred feature of the fourth procedure is to generate certificates in which 
^bsequently generated certificates have increasing sequence numbers. As a result, the network 
connection capability only needs to keep a limited size history (which changes over time) of 
previously seen certificates for each service. In addition, the size of the database that must be 


10 
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maintained can be forfher reduced by date-stamping (and/or time-stamping) the certificates in 
addition to assigning sequence numbers. If the date-stamped (and/or time-stamped) certificate 
exceeds a predetermined delta value (such as, but not limited to, for example, 1 day and/or 1 
minute), the certificate (and thus connection request) is rejected. 

5 Referring to Fig. 6, a service request is initially made to a Service Control 58 at step 1. 

In response, the Service Control 58 requests (steps 2) that the service custonier 10 initiate a 
certificate anda UNI setup contaimng sjd . The UNI setup (containing the sjd and certificate) 
is directed (step 3) from the customer 1 0 to the SVC Controller 20 that is located within the 
Network Connection Capability. 

10 In step 4, a proxy UNI is sent to the edge switch 12. As a result, PNNI is transmitted 

across the network (step 5), wMch results in a proxy UM bemg s^^ 

(located within the Network Connection Capability) at step 6. As m tibie first method, the SVC 
Controller or the Service Control 58 alerts (step 6.5) the service customer of the mcoming UNI 
and its VPLVCI. Thereafter, step 7 is performed to mitiateUM to t^^^^ 

15 The discussion above illustrates certain procedures for achieving the network coimection. 

As previously noted, the instant invention is not dependent upon the specific implencieiitation 
described above. Consequently, other implementations may be utilized \^^thout dep£ati^^ 
the spirit and/or scope of the invention. 

It is noted that the push (download) procedxire (e.&^ 

20 service providers to be connected by the Internet, whereas the other disclosed pro 

It is fiirther noted that once policy and/or logic is pushed (per the first procedure), it is locally 
available to a SVC Controller, where it can be applied in real-time to setup messages, as opposed 
to waiting to pull it in (per the second procedure) or querying to a service (per the third 
procedure). 

25 Further, the various procedures described above may be combuied. For example, the push 

procedure may be combined with the query procedure. In such a combmation, a setup can operate 
to query a service controller which then pushes policy and logic; alternatively (or in addition), 
queries can be placed on variables that represent the state of a call. 

The foregoing discussion has been provided merely for the purpose of explanation and is 

30 in no way to be construed as limitmg of the present invention. While the present mvention has 
been described with reference to exemplary embodiments, it is understood that the words which 
have been used herein are words of description and illustration, rather than words of limitation. 
Changes may be made, within the purview of the appended claims, as presentiy stated and as 
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amended, without departing from the scope and spirit of the present invention in its aspects. 
Although the present invention has been described herein vnth reference to particular means, 
rnaterMs and embodiments, the present invention is not intended to be linwted to tiie particulars 
disclosed herein; rather, the present invention extends to all functionally equivalent structures, 

5 methods and uses, such as are wthin the scope of the appended clainis. 

In accordance with various embodiments of the present uivention, the methods described 
herein are intended for operation as software programs running on a computer processor. 
Dedicated hardwe implementations including, but notlimitedtd, application specific integrated 
circuits, progrtomable logic arrays and other hardw^^ 

10 implement the methods described herein. Furthermore, alternative software implementations 
including, but not limited to, distributed processing or component/object distributed processing, 
parallel processing, or virtual machine processing can also be constructed to impleinent t^^^^^^ 

methods described herem. 

It is also noted that the software implementations of the present invention as described 

15 herein are optionally stored on a tangible storage medium, such as: a magnetic medium such as 
adisk or tape; a magheto-bptical or optical medhnn such as a disk; br a solid state medium such 
as a memory card or other padcage that ho^^^ 

; random accessmemories,OT^ 

e-mail or other self-contained information archive or set of archives is considered a distribution 

20 medium equivalent to a tangible storage medium. Accordingly, the invention is considered to 
include a tangible storage medium or distribution medium, as listed herein and including art- 
recognized equivalents and successor media, in which the software unplementations herein are 
stored. • 

In addition, although the present specification describes components and functions 
25 implemented in the embodiments with references to particular standards and protocols, the 
invention is not limited to such standards and protocols. The standards for Internet and other 
packet-switched network transmission (e.g., TCP/IP, UDP/1P,HTML, SIITML, DHTML, XML, 
PPP, FTP, SMTP, MIME); peripheral control (TrDA; RS232e; USB; ISA; ExCA; PCMCIA); and 
public telephone networks OSDN, ATM, xDSL) rq)resent examples of the 
30 standards are periodically superseded by faster or more efficient equivalents having essentially 
the same functions. Replacement standards and protocols having the similar fimctions are 
considered equivalents. 
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We claim; 

1. A multiservice switching system, comprising: 

a switching device having predetermined functions with respect to a request for a 
predetermined service; 

5 a switch controller having a bearer function and a virtual switch function for controlling 

said switching device; and 

a proxy device containing at least one of service policies and logic related to one of 
enablmg and denying said predetermiiied service, in 

with respective services to enable at least one appropriate policy aiid logic. 
10 2. The multiservice switching systemof claim 1, wherein said switching device and said 

switch controller comprise a conventional switch. 

3. The multiservice switching system of claim 2, wherein said conventional switch 
comprises an ATM Switch. 

4. The multiservice switching system of claim 2, wherein said switching device and said 
15 switch controller comprise a next generation switch. 

5. The multiservice switching system of claim 1, further comprising a service controller, 
said service controller including said switch controller. 

6. The multiservice switching system of claim 1 , wherein said switching device includes 
said switch controller. 

20 7. A method for switching plural forms of data, comprising: 

having an initiating customer request a service; 
obtaining predetermined data related to the requested service; 

instructing the initiating customer to initiate a predetermined setup identifying the 
requested service, when the requested service is permitted; 
25 passing a predetermined signal across a network in response to the predetermined setup; 

■ and . 

initiating a second predetermined setup, in response to the passed predetermined signal, 
to one of accept and reject the requested service, the second predetermined signal being provided 
to the initiating customer, in which multiple service requests are correlated with respective 
30 services to enable at least one appropriate policy and logic. 

8. The method of claim 7, wherein obtaining comprises pUshmg the predetermined data. 

9. The method of claim 8, wherein the pushing predeterinined data comprises pushing 
least one of policy and logic representing at least one of service capabilities and service 
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permissions. 

10. The method of claim 7, wherein obtaining comprises pulling the predetermined data, 

11. The method of claim 7, wherein obtaining comprises querying a service control 
module for the predetermined data. 

5 12, The method of clakn 7, further comprism^ 

setup parameters. : 

' 13, The method of claim 12, further comprising encrypting the certificate. 

14. The method of claim 13, further comprising assigning a sequence number to the 
encrypted certificate . 

10 15. The method of claim 12, wherein the certificate further identifies which service 

allowed the setup. 

16. The method of claim 12, further comprising determining whether the certificate is 

valid. 

17. The method of clahn 12, fiirther comprising preventing reuse of the certificate. 

15 18. The method of claim 17, \\4ierein preventing comprises examining a sequence number 

assigned to the certificate to determine whether the sequence number was seen before. 

19. The method of claim 17, wherein preventing comprises examinmg at least one of a 
time-stamp and a date-stamp to determine wherein the at least one of the time-stamp and the date- 
stamp exceeds a predetermined delta value. 
20 20. A method for switching plural forms of data, comprising: 

initiating a service request by an initiating customer; 
establishing the service request using a predetermined setup; and 
initiating a second predetermined setup to one of accept and reject the requested service, 
in which multiple service requests are correlated with respective services to enable at least one 
25 appropriate poUcy and logic. 

21; The method of claim 20, wherein establishmg the service request comprises usmg a 
pushing procedure. 

22. The method of claim 20, wherein establishing the service request comprises using a 
pulUng procedure. 

30 23. The method of claim 20, wherein establishing the service request comprises using a 

query procedure. 

24. Themethodof claim 20, further comprising a Service Conttol that requests that t^^^ 
initiating customer initiate a user-to network interface setup. 
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25. The method of claim 20, wherein the service request is transferred ^ot an ATM 
network, the predetermined setup being redirected ffom a switching device to a service controller. 

26. The method of claim 25, further comprising controlhng the switching device vnii a 
switch controller, the switch controller being integral with the switching device, : 

5 27. The method of claim 25, florther comprismg controlling the swtching device with a 

switch controller, the switch controller being mtegral with the service controller. 

28. The method ofclaim 20, wherein estabUshing further cornp^ 
for estabUshing the service request using the predetermhied setup. 

29. The method ofclaim 28, wherein the certificate specifies pennitted setup pa^ 
10 30. The method of clahn 28, further comprising encrypthig the certificate. 

31. The method of claim 30, further comprising assigning a sequence number to the 
encrypted certificate. 

32. The method of claim 28, wherein the certificate further identifies which service 
allowed the setup. 

15 33/ The method of claim 28, further comprising deteim^ 

valid.;-; 

34. The method of claim 28, further comprismg preventmg reuse of the certificate. 

35. The method of claim 34, wherein preventing comprises examirung a sequence number 
assigned to the certificate to determme whether the sequence nimiber was previously examined, 

20 36. The method of claim 34, wherein preventmg comprises examining at least one of a 

time-stamp and a date-stamp to determine whether the at least one of the time-stamp and the date- 
stamp exceeds a predetermined delta value. 

37. The method of claim 7, wherein the predetermined setup comprises a UNI setup, the 
predetermined signal comprises a PNNI protocol, and the second predetermined setup comprises 

25 ^ a second UNI setup. 

38. The method of claim 20, wherein the predetermined setup comprises a user-to-network 
. . interface setup. 


15 
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